cross-posted from: https://infosec.pub/post/9811127
Two of the UK’s biggest supermarket chains, Tesco and Sainsbury’s, were hit with technical issues on Saturday; Sainsbury’s blames a software update (Bloomberg.com)
Bloomberg.com: Two of the UK’s biggest supermarket chains, Tesco and Sainsbury’s, were hit with technical issues on Saturday; Sainsbury’s blames a software update — Two of the UK’s biggest supermarket chains - Tesco and Sainsbury’s - were hit with technical issues on Saturday.
Partner went into one of the larger stores today (she works there) and it was absolutely pandemonium. Credit to the staff because from what I understand some customers got very, very upset.
This because their checkout are just Windows PC with what I guess is some big wigs’ nephew’s VB/C# app running?
It’s not just the wastefulness of the overly large software stack, and the massively overblown hardware requirements that adds, it’s the size of the attack surface. Oh and lack of control of a closed platform.
What a grown up would have done is a tiny Linux thing that ran nothing but what was required and locked down. Made with Buildroot or Yocto. Running on some low power ARM thing.
I’m guess they have got some Windows infection.
It doesn’t sound like you’re aware of PCI DSS
Regulatory burden aside, you don’t do data analysis at scale running “some big wigs’ nephew’s VB/C# app.”
I’ve not worked directly with any of these payment systems, but I can’t believe the only solution is go all 90s style Windows based system. There will be embedded ways that comply to regs.
I can see they are Windows based when there is issues. I’m sure of Tesco and Morrisons but Sainsburys I don’t go to often enough to have see an issue that bring up Windows. I was being flippant, but I don’t hold using Windows to build stuff in high regard. In my experience the software engineers who doing that don’t know anything else.
It’s very likely to be one of the NCR platforms. If I were to hazard a guess, StoreLine. Though it could be Encor/ISS45, ECRS has a pretty big market share as well. POS software is a walled garden of security through obscurity. Windows dependencies tend to be in part because it is such a small market, but also due to workstation/server requirements as well as remote support.
Long time support and stability are the name of the game. The industry doesn’t allow for much downtime which makes any change significantly harder than a lot of other industries.
I’m sure these brands/sector will end up Linux too at some point. I’m half expecting MS to move to the Linux kernel themselves in the not too distant future, so no matter how trailing edge they are, they could get dragged in.
I’m out of the industry now, but I was saying the same. Win 10 Embedded and Win 7 IoT both served very, very well. But the always online component and other issues with 11 make it poorly suited for the use case it had in the past. Systems that relied on mapped drives are now nearly fully depreciated.
I’ve not touched Windows Embedded much, but I did once know Windows guts well. For 11 years it was my work development platform . Last thing I did was a virtual filesystem of an internal version control system for game artwork and I put a TortoiseSVN like interface for it into Explorer. Doing those destroyed what respect I had for Windows. I’ve been in embedded Linux for 12 years now.
Edit: 24 years of developing stuff. I’m getting old!
Very nice! I am what we in the industry call a fraud :^)
JK, I’m just not well versed in development or high level things. I’m in the administration, implementation and advisory side of things these days. I was a field tech prior.
One day I’ll get more into the weeds of it all. Nothing but respect for the devs that hold it all together
Yes, the thing that tallies up how much cash should be left in the till, operated by people on minimum wage, has been coded by the CEO’s nephew. Sure.
I’m sure they would do the sensible thing and get a big hot shot Japanese tech company to do it.
Yeah how about Fujitsu?
Look, I wasn’t arguing that it was quality software, merely that it wasn’t coded by the CEO’s nephew.
What do you do when you need to update all the machines with your setup?
A common way is to have two (or more) system partitions. You update one, charge the boot one and reboot. Typically the system partition is read only use. The bootloader tries the one it is told to try first, if it finds itself back in the bootloader it boots the other. You have a watch dog that resets if not kicked.
Buildroot and Yoctor give you a few update options. Then there is things like: https://swupdate.org/
And it’s not really that hard to role your own.
